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Abstract. We analyse various prominent quantum repeater protocols in the context 
of long-distance quantum key distribution. These protocols are the original quantum 
repeater proposal by Briegel et al , the so-called hybrid quantum repeater using 
optical coherent states dispersively interacting with atomic spin qubits, and the DLCZ- 
type repeater using atomic ensembles together with linear optics and, in its most 
recent extension, heralded qubit amplifiers. For our analysis, we investigate the 
most important experimental parameters of every repeater component and find their 
minimally required values for obtaining a non-zero secret key. Additionally, we examine 
in detail the impact of device imperfections on the final secret key rate and on the 
optimal number of rounds of distillation when the entangled states are purified right 
after their initial distribution. 
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1. Introduction 



Quantum communication is one of the most exciting and well developed areas of 
quantum information. Quantum key distribution (QKD) is a sub-field, where two 
parties, usually called Alice and Bob, want to establish a secret key. For this purpose, 
typically, they perform some quantum operations on two-level systems, the qubits, 
which, for instance, can be realized by using polarized photons. In this paper, we 
assume that Alice and Bob trust completely their measurement apparatus. To be more 
realistic, it is possible to relax this assumption and to consider device-independent 
quantum key distribution (Dl-QKD) [H Ej [3], HI [5] . An analysis of the performance of 
long-distance Dl-QKD can also be done using those methods that we will develop in 
this paper. However, here the focus is on standard QKD over large distances. 

Photons naturally have a long decoherence time and hence could be transmitted 
over long distances. Nevertheless, recent experiments show that QKD so far is limited 
to about 150 km [6], due to losses in the optical- fibre channel. Hence, the concept of 
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quantum relays and repeaters was developed [H El El [101 [H]- These aim at entangling 
qubits over long distances by means of entanglement swapping and entanglement 
distillation. There exist various proposals for an experimental implementation, such 
as those based upon atomic ensembles and single-rail entanglement [12], the hybrid 
quantum repeater [13], the ion-trap quantum repeater [Tl], repeaters based on 
deterministic Rydberg gates [151 [IB], and repeaters based on nitrogen- vacancy (NV) 
centres in diamond [T7] . 

In this paper, we analyse the performance of quantum repeaters within a QKD set- 
up, calculating secret key rates as a function of the relevant experimental parameters. 
Previous investigations on long-distance QKD either consider quantum relays [9l[miT8]. 
which only employ entanglement swapping without using quantum memories or 
entanglement distillation, or, like the works in [T9l [20] . they exclusively refer to the 
original Duan-Lukin-Cirac-ZoUer quantum repeater [12]. Here, our aim is to quantify 
the influence of characteristic experimental parameters on the secret key rate for three 
different repeater schemes, namely the original quantum repeater protocol [7|, the hybrid 
quantum repeater [13], and a recent variation of the DLCZ-repeater [21]. In order to 
reduce the complexity of every full repeater protocol, we always allow entanglement 
distillation to take place only directly after the initial entanglement distribution. The 
influence of distillation during later stages of the repeater, as well as the comparison 
between different distillation protocols, will be studied elsewhere [22]. 

This manuscript is organized as follows: In section [2] we present a description of 
the relevant parameters of a quantum repeater, as well as the main tools for analysing 
its performance for QKD. This section should also provide a general framework for 
analysing other existing quantum repeater protocols, and for studying the performance 
and the potential of new protocols. Sections [3l HI and [5] investigate long-distance QKD 
protocols for three different quantum repeater schemes; these sections can be read 
independently. Section [3] is devoted to the original proposal for a quantum repeater 
[7], section m analyses the hybrid quantum repeater [13], and finally, in section [5l we 
investigate quantum repeaters with atomic ensembles [12] • The conclusion will be given 
in section |6l and more details on the calculations will be presented in the appendix. 

2. General framework 

2.1. Quantum repeater 

The purpose of this section is to provide a general framework that describes formally 
the theoretical analysis of a quantum repeater. 

2.1.1. The protocol Let L be the distance between the two parties Alice and Bob 
who wish to share an entangled state. A quantum repeater consists of a chain of 2^ 
segments of fundamental length Lq := and 2^ — 1 repeater stations which are 

placed at the intersection points between two segments (see figure [1]). Each repeater 
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station is equipped with quantum memories and local quantum processors to perform 
entanglement swapping and, in general, also entanglement distillation. In consecutive 
nesting levels, the distances over which the entangled states are shared will be doubled. 
The parameter is the maximal nesting level. 
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Figure 1. Scheme of a generic quantum repeater protocol. We adopt the nested 
protocol proposed in The distance between Alice and Bob is L, which is divided 
in 2^ segments, each having the length Lq := . The parameter n describes the 

different nesting levels, and the value N represents the maximum nesting level. In this 
paper, we consider quantum repeaters where distillation is performed exclusively before 
the first entanglement swapping step. The number of distillation rounds is denoted by 
k. 



The protocol starts by creating entangled states in all segments, i.e., between two 
quantum memories over distance Lq. After that, if necessary, entanglement distillation 
is performed. This distillation is a probabilistic process which requires sufficiently many 
initial pairs shared over distance Lq. As a next step, entanglement swapping is performed 
at the corresponding repeater stations in order to connect two adjacent entangled pairs 
and thus gradually extend the entanglement. In those protocols where entanglement 
swapping is a probabilistic process, the whole quantum repeater protocol is performed 
in a recursive way as shown in figure [H Whenever the swapping is deterministic (i.e., it 
never fails), then all swappings can be executed simultaneously, provided that no further 
probabilistic entanglement distillation steps are to be incorporated at some intermediate 
nesting levels for enhancing the fidelities. Recall that in the present work, we do not 
include such intermediate distillations. 



2.1.2. Building blocks of the quantum repeater and their imperfections In this section, 
we describe the imperfections that can be present in a quantum repeater. 
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Quantum channel Let us consider photons (in form of single- or multi-photon pulses) 
travelling through optical fibres. In this case, losses scale exponentially with the length 
i.e., the transmittivity is given by [8] 



where Uatt is the attenuation coefficient given in dB/km. The lowest attenuation 
is achieved in the telecom wavelength range around 1550 nm and it corresponds to 
«att = 0.17 dB/km. This attenuation will also be used throughout the paper. Note that 
other types of quantum channels, such as free space, can be treated in an equivalent way 
(see e.g. [23]). Further note that besides losses we do not explicitly include channel errors 
that would cause decoherence of the initially prepared entangled states. Instead, the 
entire effect of the quantum channel is absorbed into what we consider the initial state, 
i.e., the state which is shared between two neighbouring repeater stations over distance 
Lq (see below). The amplitude damping that occurs in these elementary segments 
typically has a significant impact on the final pair generation and secret key rates, either 
directly through a decreasing number of detectable photons at the receiving stations or 
indirectly through a decrease of the entanglement fidelity (like for the hybrid quantum 
repeater which uses multi-photon pulses). 

Source of entanglement The purpose of a source is to create entanglement between 
quantum memories over distance Lq. An ideal source produces maximally entangled 
Bell states (see below) on demand. In practice, however, the created state may not 
be maximally entangled and may be produced in a probabilistic way. We denote by 
po a state shared between two quantum memories over the elementary distance Lq 
and by Pq the total probability to generate and distribute this state. This probability 
would contain any finite local state-preparation probabilities before the distribution, 
the effect of channel losses, and the success probabilities of other processes, such as the 
conditioning on a desired initial state po after the state distribution over Lq. 

For improving the scaling over the total distance L from exponential to sub- 
exponential, it is necessary to have a heralded creation and storage of pQ. How this 
heralding is implemented depends on the particular protocol and it usually involves a 
form of post-processing, e.g. conditioning the state on a specific pattern of detector 
clicks. This can also be a finite postselection window of quadrature values in homodyne 
detection. However, in the present work, the measurements employed in all protocols 
considered here are either photon-number measurements or Pauli measurements on 
memory qubits. 

Detectors We will consider photon-number resolving detectors (PNRD) which can be 
described by a positive-operator valued measure (POVM) [23] with elements 



7]t {£) := 10 10 , 



(1) 




m=0 
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Here, H^") is the element of the POVM related to the detection of n photons, ?7d is the 
efficiency of the detector, and \n + m) is a state of {n + m)-photons. In the POVM 
above, we have neglected dark counts; we have proven analytically for those protocols 
considered in this paper that realistic dark counts of the order of 10~^ are negligible. 
Note that we consider PNRD throughout this work; of course, the whole analysis could 
also be extended to threshold detectors. 

Gates Imperfections of gates also depend on the particular quantum repeater protocol. 
In our analysis, we will characterize them using only one parameter which describes a 
particular type of error. The gate quality will be denoted by pc (see (fT9!) and ( 12^ ). 
Other types of imperfections can be modelled in an analogous way. 

Quantum memories Quantum memories are a crucial part of a quantum repeater. 
Here, we will not explicitly study the role of decoherence in form of some additional 
memory error model such as memory dephasing. Such decoherence effects have been 
studied independently of QKD in [251 126] . but also in the context of QKD in [26] . 
However, here we do include a memory quantum efficiency represented by the parameter 
rjmi whenever it is appropriate. This is the probability that a photon is released when 
a reading signal is applied to the quantum memory, or, more generally, the probability 
that an initial qubit state is still intact after write-in, storage, and read-out. 

Entanglement distillation As mentioned before, throughout this work we only consider 
distillation at the beginning of each repeater protocol. Entanglement distillation is a 
probabilistic process requiring local multi-qubit gates and classical communication. In 
this paper, we consider the protocol by Deutsch et al [27lJtl . This protocol performs 
especially well when there are different types of errors (e.g. bit flips and phase flips). 
However, depending on the particular form of the initial state and on the particular 
quantum repeater protocol, other distillation schemes may perform better (see [22] for a 
detailed discussion) . The Deutsch et al protocol starts with 2^ pairs and after k rounds, 
it produces one entangled pair with higher fldelity than at the beginning. Every round 
requires two CNOTs, each performed on two qubits at the same repeater station, and 
projective measurements with post-selection. 

Distillation has two main sources of errors: imperfect quantum gates which no 
longer permit to achieve the ideal fldelity, as well as imperfections of the quantum 
memories and the detectors, decreasing the success probability. We denote the success 
probability in the z-th distillation round by Pd[^^]- 

Entanglement swapping In order to extend the initial distances of the shared 
entanglement, entanglement swapping can be achieved through a Bell measurement 

f For the quantum repeater with atomie ensembles (section [5]), we do not consider any additional 
distillation on two or more initial memory pairs. 
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performed at the corresponding stations between two adjacent segments. Such a 
Bell measurement can be, in principle, realized using a CNOT gate and suitable 
projection measurements on the corresponding quantum memories [28]. An alternative 
implementation of the Bell measurement uses photons released from the quantum 
memories and linear optics |29] . This last technique is probabilistic, but typically much 
less demanding from an experimental point of view. 

We should emphasize that the final single-qubit rotation depending on the result of 
the Bell measurement, as generally needed to complete the entanglement swapping step, 
is not necessary when the final state is used for QKD applications. In fact, it simply 
corresponds to suitable bit flip operations on the outcomes of the QKD measurements, 
i.e., the effect of that single-qubit rotation can be included into the classical post- 
processing. 

Imperfections of entanglement swapping are characterized by the imperfections 
of the gates (which introduce noise and therefore a decrease in fidelity) and by the 
imperfections of the measurement process, caused by imperfect quantum memories and 
imperfect detectors. We denote the probability that entanglement swapping is successful 
in the n-th nesting level by -Pes'*- 

2.1.3. Generation rate of long-distance entangled pairs In order to evaluate the 
performance of a quantum repeater protocol it is necessary to assess how many entangled 
pairs across distance L can be generated per second. 

A relevant unit of time is the fundamental time needed to communicate the 
successful distribution of an elementary entangled pair over distance Lq, which is given 
by: 

To := ^, (3) 

c 

where c = 2 ■ 10^ km/s is the speed of light in the fibre channel (see e.g. [30]) and /3 is 
a factor depending on the type of entanglement distribution. Note that here we have 
neglected the additional local times needed for preparing and manipulating the physical 
systems at each repeater station. Figure [2] shows three different possibilities how to 
model the initial entanglement distribution. The fundamental time To consists of the 
time to distribute the photonic signals, Tdist, and the time of acknowledgment. Tack, 
which all together can be different for the three cases shown. 

Throughout the paper, we denote the average number of final entangled pairs 
produced in the repeater per second by -Rrep- We emphasize that regarding any figures 
and plots, for each protocol, we are interested in the consumption of time rather than 
spatial memories. Thus, if one wants to compare different set-ups for the same number 
of spatial memories, one has to rescale the rates such that the number of memories 
becomes equal. For example, in order to compare a protocol without distillation with 
another one with k rounds of distillation, one has to divide the rates for the case with 
distillation by 2^ (as we need two initial pairs to obtain one distilled pair in every round). 
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Figure 2. The fundamental time for different models of entanglement generation and 
distribution. The source (S) that produces the initial entangled states is either placed 
in the middle (a), at one side (b), or at both sides (c). In the latter case, photons are 
emitted from a source and interfere in the middle (see [?T1 152] ). 



In the literature, two different upper bounds on the entanglement generation rate 
i?REP are known. In the case of deterministic entanglement swapping {P^^ = 1) we 
have [33] 

:= (roZ^(PiJz]))"\ (4) 

with -Plo[^] being a recursive probability depending on the rounds of distillation i as 
follows [33] 

PiJz = 0] = Po, (5) 

^Lo[^>0] = — -^^L. (6) 

We remind the reader that Pnli] is the success probability in the 2-th distillation round. 
Here, 



- PnV 



(7) 



is the average number of attempts to connect 2^ pairs, each generated with probabihty 
Po. 
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In the case of probabilistic entanglement swapping, we define: 

fiS := ^ (I) /-oPSpS . i'iS' n^-W. (8) 

Note that the quantities above should be interpreted as limiting upper bounds (see 



Appendix A) on the repetition rates, derived from the minimal times needed for 
communicating the quantum and classical signals. For this minimal time duration, we 
consider explicitly only those communication times for initially generating entanglement, 
but not those for entanglement swapping and entanglement distillation. 



2.2. Quantum key distribution (QKD) 

The QKD protocol In figure [3] a general quantum key distribution set-up is shown. For 
long-distance QKD, Alice and Bob will generate entangled pairs using the quantum 
repeater protocol. For the security analysis of the whole repeater-based QKD scheme, 
we assume that a potential eavesdropper (Eve) has complete control of the repeater 
stations, the quantum channels connecting them, and the classical channels used for 
communicating the measurement outcomes for entanglement swapping and distillation 
(see figure [3]). The QKD protocol itself starts with Alice and Bob performing 
measurements on their shared, long-distance entangled pairs (see figure [3]). For this 
purpose, they would both independently choose a certain measurement from a given 
set of measurement settings. The next step is the classical post-processing and for this 
an authenticated channel is necessary. First, Alice and Bob discard those measurement 
outcomes where their choice of the setting did not coincide (sifting), thus obtaining a 
raw key associated with a raw key rate. They proceed by comparing publicly a small 
subset of outcomes (parameter estimation). From this subset, they can estimate the 
quantum hit error rate (QBER), which corresponds to the fraction of uncorrelated bits. 
If the QBER is below a certain threshold, they apply an error correction protocol and 
privacy amplification in order to shrink the eavesdropper's information about the secret 
key (for more details, see e.g. [34]). 
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Figure 3. Scheme of quantum key distribution. The state pab is produced using a 
quantum repeater. Ahce and Bob locally rotate this state in a measurement basis and 
then they perform the measurement. The detectors are denoted by dQ,d^,dQ, df and 
to each detector click a classical outcome is assigned. 



CONTENTS 



10 



Various QKD protocols exist in the literature. Besides the original QKD protocol 
by Bennett and Brassard from 1984, the so-called BB84-protocol [35], the first QKD 
protocol based upon entanglement was the Ekert protocol [1]. Shortly thereafter the 
relation of the Ekert protocol to the BB84-protocol was found [36] • Another protocol 
which can also be applied in entanglement-based QKD is the six-state protocol [371 EH] ■ 

2.2.1. The quantum hit error rate (QBER) In order to evaluate the performance of 
a QKD protocol, it is necessary to determine the quantum bit error rate. This is 
the fraction of discordant outcomes when Alice and Bob compare a small amount of 
outcomes taken from a specified measurement basis. This measurement can be modelled 
by means of four detectors (two on Alice's side and two on Bob's side, see figure [3]) where 
to each detector click a classical binary outcome is assigned. Particular care is necessary 
when multi-photon states are measured [39]. In the following, we give the definition of 
the QBER for the case of photon-number-resolving detectors and we refer to [20] for the 
definition in the case of threshold detectors. The probability that a particular detection 
pattern occurs is given by 

where the POVM II*^") has been defined in ([2]) with a subscript denoting the detectors 

given in figure [31 The superscript i refers to the measurement basis and p^^^ represents 

the state pab rotated in the basis i. 

A valid QKD measurement event happens when one detector on Alice's side and 

one on Bob's side click. The probability of this event is given by [20] 

p(«) p(«) _i_ p(0 _i_ p(0 _i_ p(0 (^(W 

-'click -'1010 "T -'0101 "T -'Olio "T -'1001- \^^) 

The probability that two outcomes do not coincide is given by [20] 



^CTT ■~ -'0110 ^ -'1001- I J 

Thus, the fraction of discordant bits, i.e., the quantum bit error rate for measurement 
basis i is [20] 

p(0 

^'^^ (12) 



-'click 

For the case that pab is a two-qubit state, we find that the QBER does not depend on 
the efficiency of the detectors, as -Pjuck ~ ^'^'^ -^err oc ri\. 

If we assume a genuine two-qubit systenjjl like in the original quantum repeater 
proposal (see section |3]) or the hybrid quantum repeater (see section H]) , without loss of 
generality §], the entangled state pab can be considered diagonal in the Bell-basis, i.e., 

X Note that the states of the DLCZ-type quantum repeaters (see section [U are only effectively two- 
qubit states, when higher-order excitations of the atom-light entangled states [12|, or those of the states 
created through parametric down conversion |21j . are neglected. 

§ As proven in [40[ I41j , it is possible to apply an appropriate local twirling operation that transforms 
an arbitrary two-qubit state into a Bell diagonal state, while the security of the protocol is not 
compromised. 
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p^^ = A 10+) (0+1 + B I0-) (0-| + C (^+1 + D 1^-) (^ll, with the probabihties 



A, B,C, D, A + B + C + D = 1, and with the dual-rai|3]] encoded Bell stated** 



|0±) = (|1010)±|0101))/V2 and |V^+) = (|1001) ± |0110))/y2 (we shall use the notation 
10^) and 1-0^) for the Bell basis in any type of encoding throughout the paper). Then 
the QBER along the directions X, Y, and Z corresponds to [6] 

ex:=B + D, ez := C + D, eY:=B + C. (13) 

Throughout the whole paper X, Y and Z denote the three Pauli operators acting on 
the restricted Hilbert space of qubits. 



2.2.2. The secret key rate The figure of merit representing the performance of quantum 
key distribution is the secret key rate -Rqkd which is the product of the raw key rate -Rraw 
(see above) and the secret fraction Too- Throughout this paper, we will use asymptotic 
secret key rates. The secret fraction represents the fraction of secure bits that may be 
extracted from the raw key. Formally, we have 

-Rqkd := -Rraw'^oo = -RREP-Pclick-Rsift'^oo, (14) 

where the sifting rate i?sift is the fraction of measurements performed in the same basis 
by Alice and Bob; e.g. for the original BB84-protocol one has i?sift = |- We point out 
that both -Rrep and r^o are functions of the exphcit repeater protocol and the involved 
experimental parameters, as we will discuss in detail later. When maximizing the overall 
secret key rate -Rqkd, there will be a trade-off between -Rrep and Too, as the secret key 
fraction Too is an increasing function of the final fidelity, while the repeater rate -Rrep 
typically decreases with increasing final fidelity. 

The secret fraction represents the fraction of secure bits over the total number 
of measured bits. We adopt the composable security definition discussed in [l2l H3] . 
Here, composable means that the secret key can be used in successive tasks without 
compromising its security. 

In the present work, we consider only two QKD protocols, namely the BB84- 
protocol and the six-state protocol, for which collective and coherent attacks are 
equivalent [iQl HI] in the limit of a large number of exchanged signals. The unique 
parameter entering the formula of the secret fraction is the quantum bit error rate 
(QBER). 

In the BB84-protocol only two of the three Pauli matrices are measured. We adopt 
the asymmetric protocol where the measurement operators are chosen with different 
probabilities [B], because this leads to higher key rates. We call X the basis used for 
extracting a key, i.e., the basis that will be chosen with a probability of almost one in 
the measurement process, while Z is the basis used for the estimation of the QBER. 

% In this paper, by dual-rail representation we mean that a single photon can be in a superposition of 
two optical modes, thus representing a single qubit. By single-rail representation we mean that a qubit 
is implemented using only one single optical mode. See [24] for additional details. 
**The ket \abcd) is a vector in a Hilbert space of four modes and the values of a, b, c and d represent 
the number of excitations in the Fock basis. 
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Thus, in the asymptotic hmit, we have i?sift = 1- The formula for the secret fraction is 

m 

rT':=l-h{ez)-h{ex), (15) 

with h{p) := — ploggP — (1 —p) log2(l —p) being the binary entropy. This formula is an 
achievable upper bound on the secret fraction. 

In the six-state protocol we use all three Pauli matrices. We call X the basis used 
for extracting a key, which will be chosen with a probability of almost one, and both 
Y and Z are the bases used for parameter estimation. In this case, the formula for the 
secret fraction is given by [H [Mjtfl 

68 1 , A + (ex -ey)/ez\ , f 1 - {ex + cy + ez)/2\ 
C := 1 - ezh ( 1 - (1 - ez)h ( ^- 1 - h{ez).{lQ) 

2.3. Methods 

The secret key rate represents the central figure of merit for our investigations. We 
study the BB84-protocol, because it is most easily implementable and can also be used 
for protocols, where pab is not a two-qubit state, with help of the squashing model [39] . 
Throughout the paper, we also report on results of the six-state protocol if applicable. 
In the previous sections, we have described all the relevant analytical formulas needed 
to calculate the secret key rate. We have performed the explicit calculations using 
the software Mathematica [15]. We did not use any approximations except for the 
quantum repeater based on atomic ensembles where we truncate the states and cut off 
the higher excitations at some maximal number (see section [5] for the details). For the 
optimizations, we have used the numerical functions provided by Mathematica. 

3. The original quantum repeater 

In this section, we consider a general class of quantum repeaters in the spirit of 
the original proposal by Briegel et al [7]. We will analyse the requirements for the 
experimental parameters such that the quantum repeater is useful in conjunction with 
QKD. 

3.1. The set-up 

The set-up that we consider in this section is applicable whenever two-qubit 
entanglement is distributed by using qubits encoded into single photons. This is the 
case, for instance, for quantum repeaters based on ion traps or Rydb erg-blockade gates. 
We emphasize that we do not aim to capture all peculiarities of a specific set-up. Instead, 
our intention is to present a fairly general analysis that can give an idea of the order of 
magnitude, which has to be achieved for the relevant experimental parameters. 

ff Note that the formula for the six-state protocol is independent of the choice of basis, when we assume 
the state of Alice and Bob pab to be Bell diagonal. Then the secret fraction reduces to = 1 — S{pe) 
with S{p) the von Neumann entropy and is the eavesdropper's state. 
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Elementary entanglement creation The probability that two adjacent repeater stations 
(separated by distance Lq) share an entangled pair is given by 

Po := Vt iU) , (17) 

where rjt {£), as defined in ([1]), is the probability that a photon is not absorbed during the 
channel transmission. In a specific protocol, Pq may contain an additional multiplicative 
factor such as the probability that entanglement is heralded or also a source efficiency. 
We assume that the state created over distance Lq is a depolarized state of fidelity Fq 
with respect to \(l>^), i.e., 

po := Fo |0+> (0+1 + (|^+> (^+1 + |^^> (^^1 + |0^> (0^1) . (18) 

The fidelity Fq contains the noise due to an imperfect preparation and the noise in the 
quantum channel. We have chosen a depolarized state, because this corresponds to a 
generic noise model and, moreover, any two-qubit mixed quantum state can be brought 
into this form using local twirling operations |l6] . 

Imperfect gates For the local qubit operations, such as the CNOT gates, we use a 
generic gate model with depolarizing noise, as considered in [7]. Thus, we assume that 
a noisy gate Obc acting upon two qubits B and C can be modelled by 

ObcPbc = PgO^c'pbc + ^^Ibc, (19) 

where O^^^' is the ideal gate operation and pc describes the gate quality. Note that, 
in general, the noisy gates realized in an experiment do not necessarily have this form, 
however, such a noise model is useful for having an indication as to how good the 
corresponding gates must be. Other noise models could be analogously incorporated 
into our analysis. Further, we assume that one-qubit gates are perfect. 



Entanglement distillation We consider entanglement distillation only before the first 
entanglement swapping steps, right after the initial pair distributions over Lq. We 
employ the Deutsch et al protocol [27] which indeed has some advantages, as shown 



in the analysis of |22]. In Appendix B.2 we review this protocol and we also present 
the corresponding formulas in the presence of imperfections. We point out that when 
starting with two copies of depolarized states, the distillation protocol will generate an 
output state which is no longer a depolarized state, but instead a generic Bell diagonal 
state. Distillation requires two-qubit gates, which we describe using (fT9l) . Different from 
the original Briegel et al scheme |^ , we do not perform an additional twirling operation 
in order to have once again a depolarized state. The reason is that this depolarization 
would require additional experimental effort and, even more importantly, we have seen 
from our simulations that this step would produce lower secret key rates. 
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Entanglement swapping The entanglement connections are performed through entan- 
glement swapping by implementing a (noisy) Bell measurement on the photons stored 
in two local quantum memories. We consider a Bell measurement that is deterministic 
in the ideal case. It is implemented using a two-qubit gate with gate quahty pc (see 
(fT9l) ). Analogous to the case of distillation, starting with two depolarized states, at the 
end of the noisy Bell measurement, we will obtain generic Bell diagonal states. Also in 
this case, it turns out that a successive depolarization decreases the secret key rate and 
this step is therefore not performed in our scheme. 



3.2. Performance in the presence of imperfections 

The secret key rate (fHI) represents our central object of study, as it characterizes the 
performance of a QKD protocol. It can be written explicitly as a function of the relevant 
parameters, 

-Rqkd = -Rrep(-^^o, -^0, N,pg, ?7d, A;)Pciick(?7d)-Rsiftroo(-^o,PG, N, k), (20) 



where -Rrep is given by (j4]) when r/d = 1 (because then Pes = 1) or by ([8]) if ?7d < l|ti 
The probability that the QKD measurement is successful is given by PcUck = Vd ^^"^ ^^e 



secret fraction Too is given by either ( 1151) or (jT6l) . depending on the type of QKD protocol. 
For the asymmetric BB84-protocol, we have Psift = 1 (see section [2l2l) . The superscript 
O refers to the original quantum repeater proposal as considered in this section. In 
order to have a non-zero secret key rate, it is then necessary that the repeater rate, 
the probability for a valid QKD measurement event, and the secret fraction are each 
non-zero too. As typically Prep > 0, Pgia > and PcUck > 0, for Pqkd > 0, it is 
sufficient to have a non-zero secret fraction. Too > 0. The value of the secret fraction 
does not depend on the distance, and therefore some properties of this protocol are 
distance-invariant . 



Minimally required parameters In this paragraph, we will discuss the minimal 
requirements that are necessary to be able to extract a secret key, i.e., we will specify 
the parameter region where the secret fraction is non-zero. From the discussion in the 
previous paragraph, we know that this region does not depend on the total distance, 
but only on the initial fidelity Pq, the gate quality pc, the number of segments 2^, and 
the maximal number of distillation rounds k. Moreover, note that even if the secret 
fraction is not zero, the total secret key rate can be very low (see below). 

t|Thc supposed link between the effect of imperfeet deteetors and tlie determinism of tlie entanglement 
swapping here assumes the following. Any incomplete detection patterns that occur in the Bell 
measurements due to imperfect detectors are considered as inconclusive results and will be discarded. 
Conversely, with perfect detectors, we assume that we always have complete patterns and thus the Bell 
state discrimination becomes complete too. Note that this kind of reasoning directly applies to Bell 
measurements in dual-rail encoding, where the conclusive output patterns always have the same fixed 
total number for every Bell state (namely two photons leading to two- fold detection events), and so 
any loss of photons will result in patterns considered inconclusive. In single-rail encoding, the situation 
is more complicated and patterns considered conclusive may be the result of an imperfect detection. 
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Table 1. Minimal initial fidelity i^o {pg is fixed to one) for extracting a secret key 
with maximal nesting level N and number of distillation rounds k for the BB84- and 
six-state protocols. 



12 3 

BB84 6S BB84 6S BB84 6S BB84 6S 



0.835 0.810 0.733 0.728 0.671 0.669 0.620 0.614 

1 0.912 0.898 0.821 0.818 0.742 0.740 0.669 0.664 

2 0.955 0.947 0.885 0.884 0.801 0.800 0.713 0.709 

3 0.977 0.973 0.929 0.928 0.849 0.848 0.752 0.749 

4 0.988 0.987 0.957 0.957 0.887 0.887 0.788 0.785 

5 0.994 0.993 0.975 0.975 0.917 0.917 0.819 0.818 

6 0.997 0.997 0.985 0.985 0.939 0.939 0.847 0.846 

7 0.999 0.998 0.992 0.992 0.956 0.956 0.872 0.870 



Table 2. Minimal pa {Fq is fixed to one) for extracting a secret key with maximal 
nesting level N and number of distillation rounds k for the BB84- and six-state 
protocols. 

» [ I 

BB84 6S BB84 6S BB84 6S BB84 6S 



- - 0.800 0.773 0.869 0.860 0.891 0.884 

1 0.780 0.748 0.922 0.910 0.942 0.937 0.947 0.942 

2 0.920 0.908 0.965 0.960 0.973 0.970 0.974 0.972 

3 0.965 0.959 0.984 0.981 0.987 0.986 0.987 0.986 

4 0.984 0.981 0.992 0.991 0.994 0.993 0.994 0.993 

5 0.992 0.991 0.996 0.995 0.997 0.997 0.997 0.997 

6 0.996 0.995 0.998 0.998 0.999 0.998 0.999 0.998 

7 0.998 0.998 0.999 0.999 0.999 0.999 0.999 0.999 



For calculating the minimally required parameters, we start with the initial state 
in f ll8p . we distil it k times (see the formulas in Appendix B.2), and then we swap the 
distilled state 2^ — 1 times (see the formulas in Appendix B.l ). At the end, a generic 
Bell diagonal state is obtained. Using f|T3|) one can then calculate the QBER, which is 
sufficient to calculate the secret fraction. 

Table [1] and table |2] show the minimally required values for Fq and pc for different 
maximal nesting levels (i.e., different numbers of segments 2^) and different numbers 
of rounds of distillation k. Throughout these tables, we can see that for the six- 
state protocol, the minimal fidelity and the minimal gate quality pc are lower than 
for the BB84-protocol. Our results confirm the intuition that the larger the number of 
distillation rounds, the smaller the affordable initial fidelity can be. 

In figure HI the lines represent the values of the minimal initial fidelity and the 
minimal gate quality for a specific A^ that allow for extracting a secret key. As shown 
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in figure HJ any lower initial fidelity requires a correspondingly higher gate quality and 
vice versa. 
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Figure 4. Original quantum repeater and the BB84-protoeol: Minimal initial fidelity 
Fq and minimal gate quality pc permitting to extract a secret key for various maximal 
nesting levels N and numbers of distillation rounds k. 



The secret key rate In this section, we will analyse the influence of the imperfections 
on the secret key rate, see ( 120|) . 

In figure |S] we illustrate the effect of gate imperfections on the secret key rate for 
different numbers of rounds of distillation and for fixed values of distance, initial fidelity, 
and maximal number of nesting levels. Throughout this whole section, we use /3 = 2 in 
(jS]) for the fundamental time, which corresponds to the case where a source is placed 
at one side of an elementary segment (see figure [2]). The optimal number of distillation 
rounds decreases as pc increases. We see from the figure that = 2 is optimal when 
Pg = 1- This is due to the fact that from /c = 1 to A; = 2, the raw key rate decreases 
by 40%, but the secret fraction increases by 850%. However, from /c = 2 to = 3, 
the raw key rate decreases once again by 40%, but now the secret fraction increases 
only by 141%. In this case, the net gain is smaller than 1 and therefore three rounds 
of distillation do not help to increase the secret key rate compared to the case of two 
rounds. In other words, what is lost in terms of success probability when having three 
probabilistic distillation rounds is not added to the secret fraction. For a decreasing pc, 
more rounds of distillation become optimal. The reason is that when the gates become 
worse, additional rounds of distillation permit to increase the secret key rate sufficiently 
much to compensate the decrease of -Rrep- 
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Figure 5. Original quantum repeater and the BB84-protocol: Secret key rate ([^0]) 
versus gate imperfections pc for different rounds of distillation k. The case fc = leads 
to a vanishing secret key rate. (Parameters: Fq = 0.9, N = 2, L ~ 600 km) 
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Figure 6. Original quantum repeater and the BB84-protocol: Number of distillation 
rounds k that maximizes the secret key rate as a function of gate quality pc and 
initial fidelity Fq. In the white area, it is no longer possible to extract a secret key. 
(Parameters: iV = 2, L = 600 km) 
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In figure E] we show the optimal number of rounds of distillation /c as a function 
of the imperfections of the gates and the initial fidelity. It turns out that when the 
experimental parameters are good enough, then distillation is not necessary at all. 




200 400 600 800 1000 

Distance L (km) 



Figure 7. Original quantum repeater and the BB84-protocol: Optimal secret key rate 
(PU)) versus distance for different nesting levels, with and without perfect detectors. 
For each maximal nesting level iV, we have chosen the optimal number of distillation 
rounds k. A nesting level > 5 no longer permits to obtain a non-zero secret key 
rate. (Parameters: Fq = 0.9 and pg ~ 0.995.) 

Let us now investigate the secret key rate (l20l) as a function of the distance L 
between Alice and Bob. In figure [7] the secret key rate for the optimal number of 
distillation rounds versus the distance for various nesting levels is shown, for a fixed 
initial fidehty and gate quality. These curves should be interpreted as upper bounds; 
when additional imperfections are included, the secret key rate will further decrease. 
We see that for a distance of more than 400 km, the value = 4 (which corresponds 
to 16 segments) is optimal. Note that with the initial fidelity and gate quality assumed 
here, it is no longer possible to extract a secret key for A^ = 5. 

In many implementations, detectors are far from being perfect. The general 
expression of the raw key rate including detector efficiencies r/d becomes 

1 /c)\N+k k 

Rr.. = ^i?sift r/f -^^^^^PO n ^^M' (21) 

using f|T^ with the repeater rate i?REP given by ([8]). The term rj'^^ arises from the 
two-fold detections for the distillation, and similarly, r/^^ comes from the entanglement 
swapping and 77^ from the QKD measurements. 

In figure [7] we observe that even if detectors are imperfect, it is advantageous to do 
the same number of rounds of distillation as for the perfect case. This is due to the fact 



CONTENTS 



19 



that the initial fidehty is so low that even with a lower success probability, the gain in 
the secret fraction produces a net gain greater than 1. 

For realistic detectors, the dark count probability is much smaller than their 
efficiency. We show in Appendix B that, provided that the dark count probability 
is smaller than 10~^, dark counts can be neglected. This indeed applies to most modern 
detectors 



4. The hybrid quantum repeater 

In this section, we will investigate the so-called hybrid quantum repeater (HQR) 
introduced by van Loock et al [13] and Ladd et al |18]. In this scheme, the resulting 
entangled pairs are discrete atomic qubits, but the probe system (also called quhus) that 
mediates the two-qubit entangling interaction is an optical mode in a coherent state. 
The scheme does not only employ atoms and light at the same time, but it also uses 
both discrete and continuous quantum variables; hence the name hybrid. The entangled 
pair is conditionally prepared by suitably measuring the qubus after it has interacted 
with two atomic qubits located in the two spatially separated cavities at two neighboring 
repeater stations. Below we shall consider a HQR where the detection is based on an 
unambiguous state discrimination (USD) scheme [l9l|50]. In this case, arbitrarily high 
fidelities can be achieved at the expense of low probabilities of success. 



Jf^.l. The set-up 

Elementary entanglement creation Entanglement is shared between two electronic 
spins (such as A systems effectively acting as two-level systems) in two distant cavities 
(separated by Lq). The entanglement distribution occurs through the interaction of the 
coherent-state pulse with both atomic systems. The coherent-state pulse and the cavity 
are in resonance, but they are detuned from the transition between the ground state 
and the excited state of the two-level system. This interaction can then be described 
by the Jaynes-Cummings interaction Hamiltonian in the limit of large detuning. Hint = 
hxZa'^a, where x is the light-atom coupling strength, a (a^) is the annihilation (creation) 
operator of the electromagnetic field mode, and Z = |0) (0| — |1) (1| is the Z operator 
for a two-level atom (throughout this section, |0) and |1) refer to the two Z Pauli 
eigenstates of the effective two-level matter system and not to the optical vacuum 
and one-photon Fock states). After the interaction of the qubus in state \a) with 
the ffist atomic state, which is initially prepared in a superposition, the output state 
is Uint [\a) (|0) + |1))/V2] = (|ae-*^/2^ |0) + \ae''>/^) |1))/V2, with 6 = 2xt an effective 
light-matter interaction time inside the cavity. The qubus probe pulse is then sent 
through the lossy fibre channel and interacts with the second atomic qubit also prepared 
in a superposition. Here we consider the protocol of [50], where linear optical elements 
and photon detectors are used for the unambiguous discrimination of the phase-rotated 
coherent states. Different from |50] , however, we use imperfect photon-number-resolving 



CONTENTS 



20 




D, D2 



Figure 8. Schematic diagram for the entanglement generation by means of a USD 
measurement fohowing j50j . The two quantum memories A and B are separated 
by a distance L^. The part on the left side (an intermediate Alice) prepares a 
pulse in a coherent state \oi)^ (the subscript refers to the corresponding spatial 
mode). This pulse first interacts with her qubit A and is then sent to the right 
side together with the local oscillator pulse (LO). The part on the right side (an 
intermediate Bob) receives the state | \/VtOi)fj_^ and produces from the LO through beam 
splitting a second probe pulse |v^'-'^)b2 which interacts with his qubit B. He further 
applies a 50:50 beam splitter to the pulses in modes hi and 62, and a displacement 
D{-y^ta cos 9/ 2) = e"^"'^""^/^^''^"'') to the pulse in mode 64. The entangled 
state is conditionally generated depending on the results of detectors Di and D2 ■ The 
fibre attenuation r]t (Lq) has been defined in IT}. 



detectors (PNRD), as described by ([2]), instead of threshold detectors. By performing 
such a USD measurement on the probe state, as illustrated in figure [H the following 
entangled state can be conditionally prepared, 

po := Fo |0+> (0+1 + (1 - Fo) |0-> , (22) 



where Fq = [1 + e-2(i+'?t(i-2'?d))« sin {e/2)y2 (see [Appendix C.l[ ) for a real, r/f(Lo) is the 
channel transmission given in ([1]), and 7]^ is the detection efficiency (see section [2.1.2p . 
Note that the form of this state is different from the state considered in section [3l It 
is a mixture of only two Bell states, since the two other (bit flipped) Bell states are 
filtered out through the USD measurement. The remaining mixedness is due to a phase 
fiip induced by the coupling of the qubus mode with the lossy fibre environment. The 
optimal probability of success to generate an entangled pair in state po can be found as 

Po = 1 - (2Fo - l)^+^ni-2vd) ^ (23) 

which generalizes the formula for the quantum mechanically optimal USD with perfect 
detectors, as given in |49], to the case of imperfect, photon-number-resolving detectors. 
The derivation is given in [Appendix C.j^. 



* One may also measure the qubus using homodyne detection [13] . However, for this scheme, final 
fidelities would be limited to Fq < 0.8 for = 10 km [T3], whereas by using unambiguous state 
discrimination, we can tune the parameters for any distance Lq, such that the fidelity Fq can be chosen 
freely and, in particular, made arbitrarily close to unity at the expense of the success probability 
dropping close to zero [49] . 



CONTENTS 



21 



Entanglement swapping A two-qubit gate is essential to perform entanglement 
swapping and entanglement distillation. In the HQR a controlled-Z (CZ) gate operation 
can be achieved by using dispersive interactions of another coherent- state probe with the 
two input qubits of the gate. This is similar to the initial entanglement distribution, but 
this time without any final measurement on the qubus [51]. Controlled rotations and 
uncontrolled displacements of the qubus are the essence of this scheme. The controlled 
rotations are realized through the same dispersive interaction as explained above. In an 
ideal scheme, after a sequence of controlled rotations and displacements on the qubus, 
the qubus mode will automatically disentangle from the two qubits and the only effect 
will be a sign flip on the |11) component of the input two-qubit state (up to single- 
qubit rotations), corresponding to a CZ gate operation. Thus, this gate implementation 
can be characterized as measurement-free and deterministic. Using this gate, one can 
then perform a fully deterministic Bell measurement (i.e., one is able to distinguish 
between all four Bell states), and consequently, the swapping occurs deterministically 
(i.e.. Pes = !)• 

In a more realistic approach, local losses will cause errors in these gates. Following 
[52] . after dissipation, we may consider the more general, noisy two-qubit operation Obc 
acting upon qubits B and C, 

ObcPbc = ' [pI{^)Pbc + Pc{x){l - p,{x)){Z^pBcZ'' + ^W^^) (24) 
where 

Pc{x) := ^1 (25) 

is the probability for each qubit to not suffer a Z error, and x := 7r-^==^j^:^; here pa 
is the local transmission parameter that incorporates photon losses in the local gates. 
The explicit formulas for entanglement swapping including imperfect two-qubit gates 



are given in Appendix C.2 



Entanglement distillation For the distillation, the same two-qubit operation as 
described above in ( IMl) can be used. It is then interesting to notice that if we start 
with a state given in fl22|) . after one round of imperfect distillation, the resulting state 
is a generic Bell diagonal state. The effect of gate errors in the distillation step is given 
Appendix C.3|||. 



m 



4-2. Performance in the presence of imperfections 

In the following, we will only consider the BB84-protocol, because it is experimentally 
less demanding and also, because we found in our simulations that the six-state protocol 
produces almost the same secret key rates, due to the symmetry of the state in f l2^ . 



f Note that we assume perfect qubit measurements for the distillation and the swapping, but imperfect 
two-qubit gates. Losses from the detectors can be absorbed into losses of the gates. 
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The secret key rate per second for the hybrid quantum repeater can be written as a 
function of the relevant parameters: 



(26) 



where -Rrep is the repeater pair-creation rate for deterministic swapping described 
in section 12.1.31 and r^^^^ is the secret fraction for the BB84-protocol f|T5|) . For the 
asymmetric BB84-protocol, we have i?sift = 1 (see section 12. 2p . The superscript H 
stands for hybrid quantum repeater. Note that the fundamental time is To = as the 
qubus is sent from Alice to Bob and then classical communication in the other direction 
is used (see section [2.1.31 and figure [2]). Further notice that the final projective qubit 
measurements which are necessary for the QKD protocol are assumed to be perfect. 
Thus, the secret key rate presented here represents an upper bound and, depending on 
the particular set-up adopted for these measurements, it should be multiplied by the 
square of the detector efficiency. 
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Figure 9. Hybrid quantum repeater with perfect quantum operations {pc = 1) and 
perfect detectors {rjd = 1) (black lines) compared to imperfect quantum operations 
{pg = 0.995) and imperfect detectors {'qa = 0.9) (orange lines): Secret key rate per 
second (p6|) as a function of the initial fidelity for 2'^ segments [N = 3) and various 
rounds of distillation k. The distance between Alice and Bob is 600 km. 



The secret key rate Figure [9] shows the secret key rate for 2^ segments (A^ = 3) for 
various rounds of distillation. We see from the figure that for the hybrid quantum 
repeater the secret key rate is not a monotonic function of the initial fidelity. The 
reason is that increasing Fq decreases Pq (see (123!) ) and vice versa. We find that the 
optimal initial fidelity, i.e., the fidelity where the secret key rate is maximal, increases as 



CONTENTS 



23 



Table 3. Hybrid quantum repeater without imperfections {pQ = 1 and rjd = 1): 
Initial fidelity that maximizes the secret key rate in ([26| for a given number 2^ of 
segments and k rounds of distillation. 
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0.898 


0.836 


0.765 


0.705 
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0.946 


0.876 


0.788 


0.715 


3 


0.972 


0.907 


0.812 


0.726 


4 


0.986 


0.931 


0.834 


0.741 



the maximal number of segments increases (see table [3l). On the other hand, examining 
the optimal initial fidelity as a function of the distance, it turns out that it is almost 
constant for L > 100 km. Thus, for such distances, it is neither useful nor necessary 
to produce higher fidelities, because these would not permit to increase the secret key 
rate. 

We also observe that the maximum of the initial fidelity is quite broad for small A^, 
and gets narrower as increases. If we now consider perfect gates and perfect detectors, 
we see that by fixing a certain secret key rate, we can reach this value with lower initial 
fidelities by performing distillation. Furthermore, by distilling the initial entanglement, 
we can even exceed the optimal secret key rate without distillation by one order of 
magnitude. However, note that distillation for k rounds requires 2^ memories at each 
side. If we then assume that we choose the protocol with no distillation and perform it in 
parallel 2^ times, i.e., we use the same amount of memories as for the scheme including 
distillation, the secret key rate without distillation (as shown in figure [9]) should be 
multiplied by 2^. As a result, the total secret key rate can then be even higher than 
that obtained with distillation. 

Let us now assess the impact of the gate and detector imperfections on the secret 
key rate (orange lines) in figure |9l We notice that pc has a large impact even if it is 
only changed by a small amount, like here from = 1 to = 0.995; the secret key 
rates drop by one order of magnitude. Imperfect detectors are employed in the creation 
of entanglement. As we see in figure [TOl imperfect detectors do not affect the secret 
key rate significantly. As for A^ = 3 and A; = 0, improving the detector efficiency from 
0.5 to 1 leads to a doubling of the secret key rate. We conclude that for the hybrid 
quantum repeater, the final secret key rates are much more sensitive to the presence of 
gate errors than to inefficiencies of the detectors. However, recall that in our analysis, 
we only take into account detector imperfections that occur during the initial USD- 
based entanglement distribution. Any measurements on the memory qubits performed 
in the local circuits for swapping and distillation are assumed to be perfect, whereas the 
corresponding two-qubit gates for swapping and distillation are modeled as imperfect 
quantum operations. 
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Figure 10. Hybrid quantum repeater with perfect gates [pc = 1): The optimal 
secret key rate pG]) for the BB84-protocol in terms of the detector efficiency rjd for the 
distance L = 600 km with various numbers of segments 2^ and rounds of distiUation 
k. 



Minimally required parameters As we have seen in the previous section, it is also worth 
finding the minimal parameters for Fq and pc-, for which we can extract a secret key. 
Figure [11] shows the minimal initial fidelity required for extracting a secret key as a 
function of the local transmission probability pc-, which was introduced in section 14.11 
We obtain also the minimal values of the local transmission probability p™]^ without 
distillation (solid lines in figure [TTl) . If pc < Pg^n^ then it is no longer possible to extract 
a secret key. As shown in figure [HI these minimal values (for which the minimal initial 
fidelity becomes Fq = 1, without distillation) are Pq^^ = 0.853 (not shown in the plot), 
pgi^ ^ Q g4g^ ^min ^ q 977^ ^^^^ ^min ^ Q_ggg ^^^^ ghowu in the plot). When including 

distillation, we can extend the regime of non-zero secret key rate to smaller initial 
fidelities at the cost of better local transmission probabilities. So there is a trade-off: if 
we can produce almost perfect Bell pairs, that is initial states with high fidelities Fq, 
we can afford larger gate errors. Conversely, if high-quality gates are available, we may 
operate the repeater with initial states having a lower fidelity. Note that these results 
and figure [11] do not depend on the length of each segment in the quantum repeater, 
but only on the number of segments. 

In figure [12] we plotted the optimal secret key rate for a fixed local transmission 
probability pc and detector efficiency rjd in terms of the total distance L. We varied 
the number of segments 2^ and the number of distillation rounds k. We observe that a 
high value of k is not always advantageous: There exists for every an optimal k, for 
which we obtain the highest key rate. We see, for example, that for A^ = 1, the optimal 
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Figure 11. Hybrid quantum repeater with distillation and imperfections: Minimal 
initial fidelity as a function of the local transmission probability for various maximal 
numbers of segments 2^ and rounds of distillation k. If the initial fidelity is smaller 
than the minimal initial fidelity, then it is no longer possible to extract a secret key. 
The lines with fc = correspond to entanglement swapping without distillation. 



choice is k = 2, whereas for = 3, the optimal /c is 3. One can also see that there are 
distances, where it is advantageous to double the number of segments if one wants to 
avoid distillation, as, for example, for iV = 3 and iV = 4 at a distance of around 750 
km. 

5. Quantum repeaters based on atomic ensembles 

The probably most influential proposal for a practical realization of quantum repeaters 
was made in [12] and it is known as the Duan-Lukin-Cirac-Zoller (DLCZ)-protocol. 
These authors suggested to use atomic ensembles as quantum memories and linear 
optics combined with single-photon detection for entanglement distribution, swapping, 
and (built-in) distillation. This proposal influenced experiments and theoretical 
investigations and led to improved protocols based on atomic ensembles and linear 
optics (see [30] for a recent review). 

To our knowledge, the most efficient scheme based on atomic ensembles and linear 
optics was proposed very recently by Minaf et al [21]. These authors suggest to use 
heralded qubit amplifiers [53] to produce entanglement on demand and then to extend 
it using entanglement swapping based on two-photon detections. The state produced 
at the end of the protocol no longer contains vacuum components and therefore can 
be used directly for QKD. This is an improvement over the original DLCZ protocol in 
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Figure 12. Hybrid quantum repeater with imperfect quantum operations {pc = 
0.995) and imperfect detectors {rjd = 0.9): Optimal secret key rate for the BB84- 
protocol as a function of the total distance L, for various numbers of segments 2^ and 
rounds of distillation k. For = 5, it is not possible to obtain a secret key when 
distillation is applied. 



which the final long-distance pair is still contaminated by a fairly large vacuum term 
that accumulates during the imperfect storage and swapping processeqjl 

In this section, we first review the protocol proposed in [21] and then we analyse 
the role of the parameters and the performance in relation to QKD. 



5.1. The set-up 

The protocol is organized in three logical steps. First, local entanglement is created 
in a repeater station, then it is distributed, and finally it is extended over the entire 
distance [2Tj. 

As a probabilistic entangled-pair source we consider spontaneous parametric down- 
conversion (SPDC) which produces the state [561 157][§I 

m=0 ^ ^ ^ > 

X Very recently it was shown that in the context of QKD over continuous variables, an effective 
suppression of channel losses and imperfections can also be achieved via a virtual, heralded amplification 
on the level of the classical post-processing [S31[55]. In this case, it is not even necessary to physically 
realize a heralded amplifier. 

§ In our calculation, similar to [HI], we consider only those terms with to < 2. The reason is that the 
contribution to the total trace of the first three terms is given by 1 — and therefore for p < 0.1 the 
state obtained by considering only the first three terms differs in a negligible way from the full state. 




Figure 13. Quantum repeater based on atomic ensembles: Set-up for creation of 
on-demand entanglement (see also [H]). The whole set-up is situated at one physical 
location. A pair source produces the state /Opair- One part of the pair (the mode 
g) is stored in an atomic ensemble and the other part (mode in) goes into a linear- 
optics network. A single-photon source produces the states pffngi^ and p^^gie which 
go through a beam splitter of reflectivity R. The output modes of the beam splitter 
are called c and out. The mode out is stored in a quantum memory and the mode c 
goes into a linear-optics network which is composed of a polarizing beam splitter in 
the diagonal basis ±45° (square with a circle inside), two polarizing beam splitters in 
the rectilinear basis (square with a diagonal line inside), and four detectors. 

where B'^ := {gljin^jj + gyiriy)/ The operator gj {in\) denotes a spatial mode with 
polarization given hj i = H, V. The pump parameter p is related to the probability to 
have an n-photon pulse by P{n) = p"(l — p). 

A probabilistic single-photon source with efficiency q produces states of the form 

PWe:=(l-?)|0)(0|+W|0)(0|«- (28) 
where aj(aj) is the creation (annihilation) operator of a photon with polarization 
i = H,V. 

We also define by 7rcp the smallest repetition rate among the repetition rates of the 
SPDC source and the single-photon sources. 

On-demand entanglement source The protocol that produces local entangled pairs 
works as follows (see figure fT3] and [21] for additional details): 

(i) The state ppair ® p^ngic ® PLgic is produced. 

(ii) The single photons, which are in the same spatial mode, are sent through a 
tunable beam splitter of reflectivity R corresponding to the transformation — >■ 
\/R Ci + Vl ~ R outi. 
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(iii) The spatial modes in and c are sent through a hnear-optics network which is part 
of the heralded qubit amplifiers, and the following transformations are realized, 

(is + c?4 + c?2 - di ds + di- d2 + di 
ch ^ , cv , (29) 

d2 + di + d-i - di . d2 + di- ds + d^ 
iuh -> , mv , (30) 

where di, d2, d^, d^ are four spatial modes, corresponding to the four detectors. 

(iv) A twofold coincidence detection between di and d^ (or di and ^4 or ^2 and ^3 or 
d2 and d^) projects the modes g and out onto an entangled state. These are the 
heralding events that acknowledge the storage of an entangled pair in the quantum 
memories out and (7. The probability of a successful measurement is given by 

(31) 

where p'g^out,di,d2,d3,d4 total state obtained at the end of step (iii) and the 

superscript s stands for source. The POVM for the detectors has been defined 
in ([2]). The factor 4 accounts for the fact that there are four possible twofold 
coincidences. The resulting state is 
4 

p'o{p,q,R,Vd) = ^trd,,d2,d3,d4 {'^d^iVd)^X{Vd)^X{Vd)^d,iVd)p'g,out,di,d2.ds,d4) ■ (32) 
^0 

This is the locally prepared state that will be distributed between the repeater 
stations. 

In the ideal case with perfect detectors and perfect single-photon sources, the 
resulting state (after a suitable rotation) is Pq = \(f)~^) which can be obtained 
with probability Pq = pR{l — R). In the realistic case, however, additional higher- 
order excitations are present. In [21], the explicit form of Po ciiid Pq can be found 
for the case when 1 > R ^ p and 1 ^ 1 — g. 

Therefore, we have seen that the protocol proposed in [21] permits to turn a 
probabilistic entangled-pair source (SPDC in our case) into an on-demand entangled 
photon source. In this context on-demand means that when a heralding event is obtained 
then it is known for sure that an entangled quantum state is stored in the quantum 
memories out and g. 



Entanglement distribution and swapping Once local entangled states are created, it is 
necessary to distribute the entanglement over segments of length Lq and then to perform 
entanglement swapping. Both procedures are achieved in a similar way (see figure [T4|) . 
as we shall describe in this section. Entanglement distribution is done as follows (see 
figure [H] and [21] for additional details): 

(i) Each of the two adjacent stations create a state of the form p^. We call g and out 
the modes belonging to the first station and g' and out' the modes of the second 
station. 
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Figure 14. Quantum repeater based on atomie ensembles: Set-up used for 
entanglement distribution (swapping) (see [21] for additional details). The modes 
out and out' are released from two quantum memories separated by distance Lq (or 
located at the same station for the case of swapping) and sent into a linear-optics 
network consisting of one polarizing beam splitter in the rectilinear basis (square with 
diagonal line inside), two polarizing beam splitters in the diagonal basis (square with 
circle inside), and four detectors. 



(ii) The modes out and out' are read out from the quantum memories and sent through 
an optical fibre to a central station where a linear-optics network is used in order to 
perform entanglement swapping. The transformations of the modes are as follows: 

+ di di — d2 

outn ^ , outv ^ , 

di + d2 ,1 ^3 - di 

where di, d2, ds, d^ are four spatial modes. 

(iii) A twofold coincidence detection between di and d^ (or di and ^4 or ^2 and ^3 or ^2 
and 6^4) projects the modes out and out' onto an entangled state. The probability 
of this event is given by 

PQ{p,q,R,r]d,Vmtd) = 4tr (n^, (r/mtd)n|J^(r/™trf)n^3(r/™4rf)n^^(r/^trf)p^^3,^^^ .^^^^J , (33) 

where p'g^g'^di,d2,d3,d4, total state obtained at the end of step (ii) and rjmtd '■= 

VmVt {^) Vd, with r]m being the probability that the quantum memory releases a 
photon. The factor 4 accounts for the fact that there are four possible twofold 
coincidences. The resulting state is 

P0,3,9' = -W^^dud2,da44 (ndi(r/-mtd)n°2(?7mtd)n^3(?7mid)n°^(?7mtd)p^ , ,^^^^2^^3^^J . (34) 

The state Po,g,g' is the entangled state shared between two adjacent stations over distance 
Lq. In order to perform entanglement swapping, the same steps as described above 
are repeated until those two stations separated by distance L are finally connected. 
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Formally, the probability that entanglement swapping is successful in the nesting level 
n is given by 

PEsiP. R, Vd, Vmtd) = 4tr (n^,(r/md)n|J2(^"^'^)nd3(^rnd)n|^4(r/md)pLl,5,<;',di,d2,d3,d4) ' (35) 

where p'n-i,g,gi ,d^,d2,dz,di total state resulting from steps (i) and (ii) described above 

in this section, and rjmd '■= VmVd- The swapped state is given by 
4 10 10/ 

Pn,g,g' = —(n)'^^d^42 4-i,d4 ij^dM^d)^d2iVrnd)^d3{Vrnd)^dS'^rnd) p'n-l,g,g' ,d^,d2 434^ • (36) 

Pes 

The state Pn.g.g' is the state that will be used for quantum key distribution when 
n = N . In a regime where higher-order excitations can be neglected, the state Pn,g,g' is 
a maximally entangled Bell state. In |2T] it is given the expression of the state Pn,g,g' 
under the same assumptions on the reflectivity R and the efficiency q of the single-photon 
sources as discussed regarding in (132|) . 

Given the final state pab '■= PN,g,g' it is possible to calculate PcUck and the QBER, 
using the formalism of section 12.2.21 and inserting rimd for the detector efficiency. 

The final secret key rate then reads 

^QKD = Rrep{Lo,p, N, ?7d, ?7m, 7rep, g)Pciick(^o, N, r/d, Vm, g)i?siftr™^''(Lo, p, iV, ?7d, Vm, q), 

where -Rrep is given by ([8]) with /3 = 1 for the communication time (see figure 
As for the QKD protocol, we consider the asymmetric BB84-protocol (-Rsift = 1, see 
section |2T2|) . The superscript AE stands for atomic ensembles. 

5.2. Performance in the presence of imperfections 

As in the previous sections, we shall focus on the secret key rate. The free parameters 
are the pump parameter p and the refiectivity of the beam splitter R. In all plots, we 
optimize these parameters in such a way that the secret key rate is maximized. As all 
optimizations have been done numerically, our results may not correspond to the global 
maximum, but only to a local maximum. In general, we observed that if we treat the 
secret key rate as a function of p (calculated at the optimal R), the maximum of the 
secret key rate is rather narrow. On the other hand, when calculated as a function of 
R (at the optimal p), this maximum is quite broad. 

The most favourable scenario (ideal case) is characterized by perfect detectors 
(?7d = 1), perfect quantum memories (?7„i = 1), and deterministic single-photon sources 
(g = 1) which can emit photons at an arbitrarily high rate (7rep = oo). In this case, 
the heralded qubit amplifier is assumed to be able to create perfect Bell states and the 
secret fraction therefore becomes one. The only contribution to the secret key rate is 
then given by the repeater rate. In figure [15] the optimal secret key rate versus the 
distance, obtained by maximizing over p and R, is shown (see solid lines). 

For the calculation of figure [151 ^6 have assumed that the creation of local 
entanglement, i.e., of state p^, is so fast that we can neglect the creation time. In 
the case of SPDC, the repetition rate of the source is related to the pump parameter p 
and, moreover, the single-photon sources also have finite generation rates that should 




Distance L (km) 

Figure 15. Quantum repeaters based on atomic ensembles: Optimal secret key rate 
per second versus the distance between Alice and Bob. The secret key rate has been 
obtained by maximizing over p and R. Ideal set-up (solid line) with parameters 
Vm = Vd = q = l,7rep = CO- Morc rcalistic set-up (dashed line) with parameters 

Vm - 1, m - 0.9, q ^ 0.96, -/rep = 50 MHz. 

be taken into account. For this purpose, we introduce the photon-pair preparation 
time which is given by Tq = ^ |21j . The formula for the repeater rate in this case 
corresponds to ([H]) with Tq — )■ Tq + ■ shown in figure [161 when r/d = 1 the secret 
key rate is constant for '-/rep > 10^, however, for reahstic detectors with 7]^ = 0.9, much 
higher repetition rates are required in order to reach the asymptotic value. Nowadays, 
SPDC sources reach a rate of about 100 MHz, whereas single-photon sources have a 
repetition rate of a few MHz [17] . Recently, a new single-photon source with repetition 
rate of 50 MHz has been realized [58]. In the following, we will employ 'jrep = 50 MHz. 

A consequence of imperfect detectors is that multi-photon pulses contribute to 
the final state. The protocol we are considering here is less robust against detector 
inefficiencies than the original DLCZ protocol. This is due to the fact that successful 
entanglement swapping is conditioned on twofold detection as compared to one-photon 
detection of the DLCZ protocol. However, twofold detections permit to eliminate the 
vacuum in the memories [30], thus increasing the final secret key rate. As shown in 
figure fT7t the secret key rate spans four orders of magnitude as rid increases from 0.7 to 
1. Thus, an improvement of the detector efficiency causes a considerable increase of the 
secret key rate. For example, for = 3, an improvement from 7]^ = 0.85 to rjd = 0.88 
leads to a threefold increase of the secret key rate. Notice that we have considered 
photon detectors which are able to resolve photon numbers. Photon detectors with an 
efficiency as high as 95% have been realized [59]. These detectors work at the telecom 
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Figure 16. Quantum repeaters based on atomic ensembles: Optimal secret key rate 
per second versus the basic repetition rate of the source 7].ep- The secret key rate has 
been obtained by maximizing over p and R. (Parameters: "q^ ~ Vm = 9 = !)■ 



bandwidth of 1556 nm and they have neghgible dark counts. The drawback is that 
they need to operate at very low temperatures of 100 mK. The reading efficiency of the 
quantum memory rjm plays a similar role as the detector efficiency. In accordance to 
|30] . intrinsic quantum memory efficiencies above 80% have been realized [60]; however, 
total efficiencies where coupling losses are included are much lower. 

A single-photon source is also characterized by its efficiency, i.e., the probability q 
to emit a photon. As shown in figure [T8| we see that it is necessary to have single-photon 
sources with high efficiencies, in particular, when detectors are imperfect. The source 
proposed in [58] reaches q = 0.96. 

In figure [TSl we show the secret key rate as a function of the distance between Alice 
and Bob for parameters (dashed lines) which are optimistic in the sense that they could 
be possibly reached in the near future. We observe that with an imperfect set-up and for 
= 4, the realistic secret key rate is by one order of magnitude smaller than the ideal 
value. This decrease is mainly due to finite detector efficiencies. For A^ = 4, the secret 
key rate scales proportionally to T]dVdVd^Vd (local creation, distribution, entanglement 
swapping, and QKD measurement). For rj^ = 0.9, finite detector efficiencies lead to a 
decrease of the secret key rate by 78%. Regarding the optimal pump parameter p, we 
observe in figure [T9] that for large distances (L > 600km) its value is about 0.15%. The 
order of magnitude of this value is in agreement with the results found in [20] regarding 
the original DLCZ protocol and the BB84-protocol. The optimal reflectivity R is given 
in flgure [20l We observe that as A^ increases, the optimal value of R has a modest 
increase. 
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Figure 17. Quantum repeaters based on atomic ensembles: Optimal secret key rate 
per second versus the efficiency of the detectors J^d- The secret key rate has been 
obtained by maximizing over p and R. (Parameters: i^m =9 = 1, 7rcp = 50 MHz). 




0.4 0.6 0.8 1 



Single-photon source efficiency q 



Figure 18. Quantum repeaters based on atomic ensembles: Optimal secret key rate 
per second versus the probability to emit a single photon. The secret key rate has been 
obtained by maximizing over p and R. (Parameters: = l,7rep = 50 MHz). 
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Figure 19. Quantum repeaters based on atomic ensembles: Optimal value of p versus 
the distance between Alice and Bob. The corresponding secret key rate is shown in 
figure [TSl (Parameters: r]m = 1, rjo = 0.9, q = 0.96, jrep = 50 MHz) 
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Figure 20. Quantum repeaters based on atomic ensembles: Optimal value of the 
reflectivity R versus the distance between Alice and Bob. The corresponding secret 
key rate is shown in figure [131 (Parameters: rj„i = 1, i]d = 0.9, q = 0.96, jrep = 50 
MHz) 



6. Conclusions 



Quantum repeaters represent nowadays the most promising and advanced approach 
to create long-distance entanglement. Quantum key distribution (QKD) is a developed 
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technology which has already reached the market. One of the main limitations of current 
QKD is that the two parties have a maximal separation of 150 km, due to losses in optical 
fibres. In this paper, we have studied long-distance QKD by using quantum repeaters. 

We have studied three of the main protocols for quantum repeaters, namely, the 
original protocol, the hybrid quantum repeater, and a variation of the so-called DLCZ 
protocol. Our analysis differs from previous treatments, in which only final fidelities 
have been investigated, because we have maximized the main figure of merit for QKD 
- the secret key rate. Such an optimization is non-trivial, since there is a trade-off 
between the repeater pair-generation rate and the secret fraction: the former typically 
decreases when the final fidelity grows, whereas the latter would increase when the final 
fidelity becomes larger. 

Since it is hard to compare different protocols directly, as there are different 
experimental requirements and difficulties for each of them, here we investigated the 
main aspects for every protocol separately. 

The general type of quantum repeater is a kind of prototype for a quantum repeater 
based on the original proposal [7]. We have provided an estimate of the experimental 
parameters needed to extract a secret key and showed what the role of each parameter is. 
We have found that the requirement on the initial fidelity is not so strong if distillation 
is allowed (even for Fq = 0.9, it is possible to have one secret bit per second). However, 
quantum gates need to be very good (errors of the order of 1%). 

Further, we have studied the hybrid quantum repeater. This protocol permits to 
perform both the initial entanglement distribution and the entanglement swapping with 
high efficiencies. The reason is that bright light sources are used for communication 
and Cavity Quantum Electrodynamics (CQED) interactions are employed for the local 
quantum gates, making the swapping, in principle, deterministic. We have found that 
finite detector efficiencies do not play a major role with regards to the generation 
probability. This permits to have high secret key rates in a set-up where it is possible 
to neglect imperfections of the detectors. By studying imperfect gates we found that 
excellent gates are necessary (errors of the order of 0.1%). 

Finally, we have considered repeaters with atomic ensembles and linear optics. 
There exist many experimental proposals and therefore we have studied the scheme 
which is believed to be the fastest [21]. This scheme uses heralded qubit amplifiers 
for creating dual-rail encoded entanglement and entanglement swapping based on two- 
fold detection events. In contrast to the previous two schemes, the Bell measurement 
used for entanglement swapping is not able to distinguish all four Bell states. We have 
characterized all common imperfections and we have seen that using present technology, 
the performance of this type of quantum repeater in terms of secret key rates is only 
about one order of magnitude different from the corresponding ideal set-up. Thus, this 
scheme seems robust against most imperfections. These types of repeater schemes, as 
currently being restricted to linear optics, could still be potentially improved by allowing 
for additional nonlinear-optics elements. This may render the entanglement swapping 
steps deterministic, similar to the hybrid quantum repeater using CQED, and thus 
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further enhance the secret key rates. 

For all those protocols considered here, single-qubit rotations were assumed to be 
perfect. Obviously, this assumption is not correct in any realistic situation. However, 
most of these single-qubit rotations can be replaced by simple bit flips of the classical 
outcomes which are used when the QKD protocol starts. Therefore, we see that in this 
case, specifically building a quantum repeater for QKD applications permits to relax the 
requirements on certain operations that otherwise must be satisfied for a more general 
quantum application, such as distributed quantum computation. 

In conclusion, quantum repeaters could be a possible solution for long-distance 
QKD. However, in order to achieve performances comparable to current short- distance 
QKD systems, it will be necessary to operate in parallel many of those set-ups considered 
in this paper, possibly including additional multiplexing strategies. 
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Appendix A. Additional material for the general framework 

Appendix A.l. Generation rate with probabilistic entanglement swapping and 
distillation 

In this appendix, we give the derivation of ([8]) in section 12.1.21 which describes the 
generation rate of entangled pairs per time unit Tq with probabilistic entanglement 
swapping and distillation, i.e., 

■■= ^ (^) PoP^^Ml..P^VUPo\^]. (A.1) 

In [30] the formula has been derived only for the case without distillation and there it 
reads as follows, 

pprob ._ 1 p p(l)p(2) p{N) /A r,N 

-^REP ^ I Q ^O-^ES-^ES-'-^ES ' {^■^) 



To V3, 

where Pq is the probability to generate a pair for entanglement swapping. This formula 
was derived for small Pq. 



In order to incorporate distillation into (\A.2\i we use the definition of the recursive 
probability PLo[k] given in ([6]), see [33]. It describes the generation probability of an 
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entangled pair after k rounds of purification. If we use that Zi{x) = — 1^ ^^'^ 

small x, we can rewrite PL^lk]: 

where we used in the last line that PlqW\ is a recursive formula. For deriving (lA.ip . we 
replace in ( ]A.2I) Pq by Pl^, and we use ( ]A.3I) . 



Appendix B. Additional material for the original quantum repeater 

Appendix B.l. Entanglement swapping 

The protocol We consider the total state pah ® Pcd- The entanglement swapping 
algorithm consists of the following steps: 

(i) A CNOT is applied on system h as source and c as target. 

(ii) One output system is measured in the computational basis and the other one in 
the basis {|+) := ■^^^^^7 |~) = ^'^^^^^ }, obtained by applying a Hadamard gate. 

(iii) In the standard entanglement swapping algorithm, a single qubit rotation depending 
on the outcome of the measurement is performed. However, for the purpose of QKD 
it is not necessary to do this single-qubit rotatioifl- We propose that Bob collects 
the results of the Bell measurements, performs the standard QKD measurement 
and then he can apply a classical bit flip depending on the QKD measurement 
basis and on the Bell measurement outcomes. 



Formulas in the presence of imperfections We consider a set-up with two detectors 
di and ^2- We associate the detection pattern of these two detectors with a two- 
dimensional Hilbert space, e.g di = click, ^2 = noclick =^ \H) = |lrfj,0d2) 
di = noclick, (^2 = click =^ \V) = |0rf^,lrf2) where {\H) ,\V)} are a basis of a two- 
dimensional Hilbert space which can be, for example, identified with horizontal and 
vertical polarizations of a qubit. We discard those events where there are no clicks or 
when both detectors click. If the detectors are imperfect, we may have an error in the 
detection of the quantum state. The POVM consists of two elements Uh (Hy) which 
detect mode \H) {\V)): 

nH:=l\H){H\ + {l-^)\V){V\, (B.l) 

Hv^ ■.= j\V){V\ + {l-j)\H){H\, (B.2) 

with 

J := ^<^+P<^-^(j-V<^) (B.3) 

Vd + 2pdark(l - Vd) 

* Note that this step is different from [7], where the single-qubit rotations were exphcitly included. 



CONTENTS 38 

where Pdark is the dark count probabihty of the detectors and ?7d is their efficiencjii]. 

The POVM above has been used also in [71 [61], however, the connection with the 
imperfections of the detectors was not made. 

If we start with the states pab = Pcd = A + 5 10") + C |^+) (^+| + 

D\tlj~) {ip'l, the resulting state after entanglement swapping between a and d is still a 
Bell diagonal state with coefficients of the form: 

A' = + pG [-f\A^ + B' + C' + D^) + 2(1 - i^){AD + BC) 

+27(l-7)(A + Z})(C + i?)], 
B' = + PG [2^\AB + CD) + 2(1 - ^^){AC + BD) 

+7(1 - 7)(A2 + 5^ + + + 2 AD + 2BC)] , 
C = + PG [2^\AC + 5/}) + 2(1 - 7') (^5 + CD) 

+7(1 - 7)(A2 + 52 + + ^2 + 2AD + 25C)] , 
= 1:-^ + j,^ [272(^1} + BC) + (1 - 7')(v4' + 52 + + D^) 

+27(1-7)(A + D)(5 + C)], (B.4) 
and the probability to obtain the state above is equal to 

PEs{V^Pda.Tk) ■■= ((1 - Pdark)(?7d + 2pdark(l " Vd)))"^ , (B.5) 

which can be interpreted as the probability that entanglement swapping is successful^]. 
Note that P{r],0) = rf and P(1,0) = 1 as we expect. When we consider dark counts 
Pdark < 10~^ then these are negligible as (Pe5(0.1, 10-5)/(Pi=;5(0.1, 0)))^ < 1.03^, so 
the impact on the secret key rate is minimal. 

Appendix B.2. Distillation 

The protocol We assume that Alice and Bob hold two Bell diagonal states Paifi^ and 
Pa2,b2- The algorithm is the following: 

t The coefficient 7 can be calculated as follows: the POVM for having a click under the assumption 
of single-photon sources and imperfect detectors is given by 

i?*^"^"^^ = Pdark |0) (0| + (1 - (1 -Pdark)(l ^ |1> (1| 

and no click 

^(noclick) ^ (1 |0) (0| + (1 ~pdark)(l - Vd) |1> (1| • 

When we say that the detector a clicked, and b did not click and we discard the vacuum events, and 
those where both detectors clicked, the POVM looks as follows: 

^(click) ^ ^(noclick) ^ _ (1 - ru)) (1 - Pdark) |la,Ob) (la,Ob| 

+ Pdark(l -Pdark)(l - Vd) \0a, U) (Oa, U\ ■ 

The trace is (1 — Pdark)(?7d + 2pdark(l — Vd)), which is exactly the probability that we have this 
measurement. If we normalize this measurement and relate it to the POVM in (jB.ip . we get 7. 
I This probability was derived by taking the probability of the measurement in the preceding footnote 
squared, as we need two coincident clicks for the Bell measurement. 
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(i) In the computational basis, Alice rotates her particles by ^ about the X-axis, 
whereas Bob applies the inverse rotation (— f ) on his particles. 

(ii) Then they apply on both sides a CNOT operation, where the states Oi (61) serve 
as source and a2 (^2) as target. 

(iii) The states corresponding to the target are measured in the computational basis. 
If the measurement results coincide, the resulting state Pai.fei is a purified state; 
otherwise, the resulting state is discarded. Therefore, this entanglement distillation 
scheme is probabilistic. 

Formulas in the presence of imperfections Given a Bell diagonal state with the 
following coefficients 

Pai, = A (0+1 + B 10-) (r I + C |'0+> (0+1 + D IV^-) (0-| , (B.6) 

the coefficients transform according to the following map 



A =^ {A^ + D^) , (B.7) 
B' = ^ {2AD) , (B.8) 
C" = (52 + C^) , (B.9) 

D' = ^{2BC), (B.IO) 

where Pd is the probability that the measurement outcomes are both the same for Alice 
and Bob, and thus the probability of successful distillation is: 

Polk] = {Au-i + Dk-if + {Bk-i + Cu-if . (B.ll) 

Including the gate quality pc^ these formulas change to [62] : 

PD[k] = ]^{l+pl{-l + 2Ak-i + 2Dk-if] . (B.12) 

with 

A = [I + pI{{A - B - C + D){?>A + B + C + 'iD) + A{A - Df)] /{8Pd), 
B' = [1 - pI {A^ + 2A{B + C -7D) + {B + C + Df)] /{8Pd), 
C = [l+pl{A{B-Cf -{A-B-C + D){A + ?>{B + C) + D))]/{8Pd), 
D' = [1 - pI {A^ + 2A{B + C + D) + B^ + 2B{D - 7C) + {C + Df)] /{SPd). 

Appendix C. Additional material for the hybrid quantum repeater 
Appendix C.l. Entanglement generation 

The total state before the detector measurements is described by [50] 
PAB,63,.5 = P (((|0),3 (|00)^^ 1/3),^ + |-/3),,)/2 
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+ |0),, (|01)^^ + |10)^^ l/3),3)/2)) X H.c) + 

(1 -P) (((|0),3 (100)^5 1/3),, - |-/3)63)/2 

+ |0),3 (101)^5 |-/3),3 - |10)^5 X i/.c.) , (C.l) 

where H.c. stays for the Hermitian conjugate of the previous term, A {B) represents 
the qubit at Ahce's (Bob's) side, 63 is the coherent-state mode arriving at the detector 
-Di, 65 is the coherent-state mode arriving at the detector D2, and /3 = i^/^rjt sin {6/2) 
(see figure ([H]))- The probabihty of error caused by photon losses in the transmission 
channel is given by (1 — p), with p = (1 + e~^^"^~''*'*"^^™^^^/^-')/2. It is possible to observe 
from (IC.ip that whenever Bob detects a click in either one of the detectors Di or D2, 
an entangled state has been distributed between qubits A and B. 

We discuss in the following the case that Di and D2 are imperfect PNRD (see 
When detector Di does not click and D2 clicks, the resulting state pab is then given by 



tr(n[°^n^"VAiJ,fe3,b5; 



with n > 0. The same result up to local operations can be obtained in the opposite case 
(a click in detector Di and no click in detector D2). 

Depending on the outcome of the detector, a local operation maybe applied to 
change the resulting state into the desired state. In this way, if the outcome is an even 
number, nothing should be done, otherwise a Z operation should be applied. Following 
this, the resulting state can be written as 

p = Fo |0+> (0+1 + (1 - Fo) |r> (r I , (C.3) 



where 



((ooU^ + (-1)" (iiu^) ^ (|oo)^^ + (-1)" 111) 



ABJ 



V2 V2 

- — -2 ■ (c-^) 

The probability of success is calculated by adding all successful events, and is given by 

00 

Po = 5^tr(nif n£V^«,,3,,, + n(%[^VAB,.3,.J, (cs) 

n=l 

after some transformation this can be written as in f l23|) . 
Appendix C.2. Entanglement swapping 

The initial states used in the swapping operation are a full rank mixture of the 
Bell states, po := A |0+) (0+| + B 10") + C 1?/;+) (t^+I + D l^/^") (t/;-]. After the 
connection, the resulting state will remain in the same form. A' (0+|-|-i?' |0~) + 
C (V'+l + D' but with new coefficients: 

A = 2BC + 2AD + 2{-2BC + A{B + C - 2D) + {B + C)D)pg 
HA-B-C + Dfp% 
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B' = 2AC + 2BD + {A^ + {B + Cf - ABD + + 2A{-2C + D))pg 

-{A-B-C + Dfp% 
C = 2AB + 2CD + {A^ + {B + C)^ - ACD + + 2A{-2B + D))pg 

-{A-B-C + D)Yg, 
D' = A'^ + B^ + C^ + D^- 2{A^ + B^ + C^- A{B + C) - {B + C)D + D'^)pg 

+{A-B-C + Dfpl. (C.6) 

It is possible to see that A + B' + C + D' = 1, such that even for the case of imperfect 
connection operations, the swapping occurs deterministically. 

Appendix C.3. Entanglement distillation 

We calculated also the effect of the gate error in the distillation step. Starting with two 
copies of states in the form of po := A (0~|+C |^+) {tp^\+D \tp~) {ip'], 

the resulting state after one round of distillation is given by A' l^"*") + B' + 
C {ifj+l +D'\ip'){ip-\, where 

A' = ^ [D' + A\1 + 2(-l + pg)pg)' - 2A{-1 + Pg)Pg(C + 2D + 2{B-C- 2D)pg 

+2{-B + C + 2D)pI) - 2D{-1 + pg)pg{-2D - 2{C + D){-1 + pg)pg 
+ B{1 + 2{-1+pg)pg))), 
B' = ^ {-2iD{-l + pg)pg{C + D + 2BpG - 2CpG - 2DpG - 2Bpl + 2Cpl + 2Dpl) 

+ A^pg{-1 + 3pG - Apl + 2pl) - A{D{1 - 2pG + 2plf 
-(-1 + pg)pg{-2C{-1 + pg)pg + B{1 - 2pG + 2pl))))) , 

C = ^ {B\l - 2pG + 2plf - 2B{-1 + p^)p^{-2A{-l + |)g)Pg + ^(1 - ^pg + 2pl) 

+C{2 - ApG + ApD) + C(C(1 - 2j,G + 2plf 

-2(-l + pc)pc(-2D(-l + pg)pg + ^(1 - 2pG + 2p^)))) , 

= 1^ (-2(C(-1 + Pg)pg(C^ + ^ + 2ApG - 2CpG - 2DpG - 2Apl + 2Cpl + 2Dpl) 



+ 3PG - Apl + 2pl) - B{C{1 - 2pG + 2p 



If 



-(-1 + Pg)Pg{-2D{-1 + + ^(1 - 2pG + 2pl))))) , (C.7) 

Pd is the distillation probability of success and is given by 

PD = iB + Cy + {A + Df-2{A-B-C + DfpG + 2{A-B-C + Dfpl. (C.8) 
For the case of = (IC.7P and (IC.SP are in accordance with 
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